req.body for request payload in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What does req.body contain after a POST request?

Consider an Express server with the following middleware setup:

app.use(express.json());

If a client sends a POST request with JSON payload {"name":"Alice","age":30}, what will req.body contain inside the route handler?

Express

app.post('/user', (req, res) => {
  res.json(req.body);
});

A An empty object {}

B A string containing '{"name":"Alice","age":30}'

C Undefined

D {'name': 'Alice', 'age': 30}

💡 Hint

Think about what express.json() middleware does to the incoming JSON payload.

The express.json() middleware parses the incoming JSON payload and converts it into a JavaScript object. This object is then assigned to req.body. So, req.body contains the parsed object, not a string or undefined.

📝 Syntax

intermediate

Which code correctly accesses a nested property in req.body?

Given a POST request with JSON payload:

{"user": {"email": "[e-mail]"}}

Which option correctly retrieves the email inside the route handler?

Express

app.post('/signup', (req, res) => {
  // Access email here
});

A const email = req.body.user.email;

B const email = req.body['user.email'];

C const email = req.body.user['email'];

D const email = req.body['user']['email'];

💡 Hint

Remember how to access nested object properties in JavaScript.

Option A uses dot notation correctly to access the nested email property. Options A and D are also valid JavaScript, but option A is the simplest and most common way. Option A tries to access a property named 'user.email' which does not exist.

🔧 Debug

advanced

Why is req.body undefined in this Express route?

Look at this Express server code:

const express = require('express');
const app = express();

app.post('/data', (req, res) => {
  res.send(req.body);
});

app.listen(3000);

When sending a JSON POST request, req.body is always undefined. Why?

A The route handler is missing a return statement.

B The POST request must use query parameters instead of JSON.

C The server is missing middleware to parse JSON bodies like express.json().

D The server must use app.use(express.urlencoded()) instead of express.json().

💡 Hint

Think about what Express needs to understand JSON payloads.

Express does not parse JSON request bodies by default. You must add app.use(express.json()) middleware to parse JSON and populate req.body. Without it, req.body remains undefined.

❓ state_output

advanced

What is the value of req.body after sending a form with application/x-www-form-urlencoded?

An Express app uses this middleware:

app.use(express.urlencoded({ extended: false }));

A client submits a form with fields username=joe and password=123. What will req.body contain inside the POST route?

A {'username': 'joe', 'password': '123'}

B A string 'username=joe&password=123'

C Undefined

D An empty object {}

💡 Hint

What does express.urlencoded() middleware do?

The express.urlencoded() middleware parses URL-encoded form data and converts it into a JavaScript object assigned to req.body. So req.body will be an object with keys and values from the form.

🧠 Conceptual

expert

Why should you never trust req.body data directly in Express?

When building an Express app, why is it important to validate or sanitize data from req.body before using it?

A Because <code>req.body</code> only works with JSON, not other content types.

B Because <code>req.body</code> can contain malicious data that may cause security issues like injection attacks.

C Because <code>req.body</code> is always empty unless validated first.

D Because Express automatically encrypts <code>req.body</code> data, so you must decrypt it.

💡 Hint

Think about what happens if users send unexpected or harmful data.

Data in req.body comes from the client and can be manipulated. Without validation or sanitization, this data can lead to security vulnerabilities like SQL injection, cross-site scripting, or server crashes. Always check and clean input before use.